Florian Westphal 406121ee71 bridge: netfilter: orphan skb before invoking ip netfilter hooks ... Pekka Pietikäinen reports xt_socket behavioural change after commit 00028aa37098o (netfilter: xt_socket: use IP early demux). Reason is xt_socket now no longer does an unconditional sk lookup - it re-uses existing skb->sk if possible, assuming ->sk was set by ip early demux. However, when netfilter is invoked via bridge, this can cause 'bogus' sockets to be examined by the match, e.g. a 'tun' device socket. bridge netfilter should orphan the skb just like the routing path before invoking ipv4/ipv6 netfilter hooks to avoid this. Reported-and-tested-by: Pekka Pietikäinen <pp@ee.oulu.fi> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2019-07-27 22:07:48 +02:00
..
netfilter	netfilter: ebtables: handle string from userspace with care	2019-07-27 21:52:09 +02:00
br.c
br_device.c
br_fdb.c
br_forward.c
br_if.c
br_input.c
br_ioctl.c	net: bridge: fix old ioctl unlocked net device walk	2016-06-07 10:42:54 +02:00
br_mdb.c	bridge: mdb: fix double add notification	2015-10-01 12:07:36 +02:00
br_multicast.c	bridge: fix multicast router rlist endless loop	2015-07-10 10:40:20 -07:00
br_netfilter.c	bridge: netfilter: orphan skb before invoking ip netfilter hooks	2019-07-27 22:07:48 +02:00
br_netlink.c
br_notify.c
br_private.h
br_private_stp.h
br_stp.c
br_stp_bpdu.c
br_stp_if.c	bridge: Only call /sbin/bridge-stp for the initial network namespace	2016-01-28 21:49:34 -08:00
br_stp_timer.c
br_sysfs_br.c
br_sysfs_if.c
br_vlan.c
Kconfig
Makefile